Why did it decline? TVR vs Issuer Action Codes

How the decision actually gets made

Terminal risk management produces a TVR — a five-byte record of everything that looked wrong. On its own that changes nothing. The decision comes from comparing the TVR against three five-byte masks the issuer personalised onto the card:

IAC-Denial (9F0E) — any overlapping bit means decline offline immediately, with no attempt to reach the issuer. This is the issuer saying "never approve this, do not even ask me".

IAC-Online (9F0F) — any overlapping bit means go online and let the issuer decide. Most IAC-Online values are permissive, which is why the overwhelming majority of chip transactions go online.

IAC-Default (9F0D) — used only when the terminal cannot go online, either because it has no connectivity or because it is an offline-only device. Any overlapping bit means decline.

The order matters: Denial is checked first and is absolute. Only if no Denial bit matches does the terminal consider Online (if it can go online) or Default (if it cannot).

Terminal Action Codes

Terminals carry their own equivalent masks — TAC-Denial, TAC-Online and TAC-Default — configured by the acquirer per AID. In real processing the terminal ORs the IAC and TAC together before comparing. So if a transaction went online and you cannot see why from the IACs alone, the TAC is the missing piece. It lives in terminal configuration, not on the card, so you will need the acquirer's parameter download to see it.

Typical values

A common IAC-Denial is all zeros — the issuer declines nothing outright and wants to see everything. A common IAC-Online is something like F870ACF800, which catches offline data authentication failures, expiry problems, CVM failures and the floor limit. When you see an IAC-Denial with bits set, it is usually SDA/DDA/CDA failure or PIN try limit exceeded.

If the verdict says online but you saw a decline

Then the decline came from the issuer, not the terminal, and the reason is in ISO 8583 DE 39 — not in the TVR at all. The chip data tells you why the transaction went online; the response code tells you why the issuer said no. Two different questions with two different answers.